Tor Proxy Used for Closed Source Access

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects outbound TCP connections to port 9050, which is commonly used by Tor proxies. The rule specifically looks for the initial SYN packet (flags:S) of a TCP connection from the home network to any destination on port 9050. This activity is flagged as a policy violation, indicating the use of a Tor proxy for accessing closed source resources.